/instance-0000000002/logs/es.log",
"type": "log"
}
},
```
---
### Author:  [@zanbel](https://discuss.elastic.co/u/zanbel)
#### Post date: [October 9, 2018, 9:07am UTC](https://discuss.elastic.co/t/forward-logs-from-logging-and-metrics-cluster-to-external-log-system/151531/2 "2018-10-09T09:07:56Z")
Hi @gautu7,
Under the hood we use a beats sidecar that is deployed on any ECE node (if you run `docker ps` on the host you will see a `frc-beats-runners-beats-runner` container, which picks up the log files written to the host and sends it to the logging and monitoring cluster. If you wish to send these logs to another cluster one option is to configure a [remote reindex job](https://www.elastic.co/guide/en/elasticsearch/reference/current/reindex-upgrade-remote.html). If what you are after is to send these logs to another tool you can run another shipper on the host that will pick up the logs of a specific cluster(s) to any destination.
For example the location of Elasticsearch node logs will be in `/mnt/data/elastic/{allocator_id}/services/allocator/containers/elasticsearch/{cluster_id}`.
Hope this helps.
---
### Author:  [@gautu7](https://discuss.elastic.co/u/gautu7)
#### Post date: [October 9, 2018, 1:04pm UTC](https://discuss.elastic.co/t/forward-logs-from-logging-and-metrics-cluster-to-external-log-system/151531/3 "2018-10-09T13:04:38Z")
@zanbel
Yes, I want to run another shipper which reads log files in the`/mnt/data/elasticsearch` directory and sends them out to the log server over http. In the ECE world, is it possible to install an app(external shipper) on the host since much of the setup happens under the hood? If so, how?
Also, is it possible to override the default behavior of writing to the logging-and-metrics cluster and not do this if we have access to logs and are sending them out to another external log system?
---
### Author:  [@zanbel](https://discuss.elastic.co/u/zanbel)
#### Post date: [October 9, 2018, 4:02pm UTC](https://discuss.elastic.co/t/forward-logs-from-logging-and-metrics-cluster-to-external-log-system/151531/4 "2018-10-09T16:02:39Z")
If you wish to install your own shipper, of course you can do so. I cannot provide any input around if it will break something in ECE and how it might affect ECE behaviour, how many resources will it require, etc.
You can control the installation path using the `--host-storage-path` param, more info is available [here](https://www.elastic.co/guide/en/cloud-enterprise/2.0/ece-installation-script-set-logging-and-metrics-policy.html).
---
### Author:  [@gautu7](https://discuss.elastic.co/u/gautu7)
#### Post date: [October 9, 2018, 5:12pm UTC](https://discuss.elastic.co/t/forward-logs-from-logging-and-metrics-cluster-to-external-log-system/151531/5 "2018-10-09T17:12:09Z")
@zanbel Thanks!
It's a pretty straight forward log forwarder reading log files, we'll take care of the environment specific details.
I had another question in my previous post -
`Also, is it possible to override the default behavior of writing to the logging-and-metrics cluster and not do this if we have access to logs and are sending them out to another external log system?`
Is this possible, and how? We do not want to be duplicating log stores without having any adverse effects on ECE.
---
### Author:  [@zanbel](https://discuss.elastic.co/u/zanbel)
#### Post date: [October 10, 2018, 9:40am UTC](https://discuss.elastic.co/t/forward-logs-from-logging-and-metrics-cluster-to-external-log-system/151531/6 "2018-10-10T09:40:16Z")
Completely disable the writing to this cluster is not possible as we rely on the logs indexed there for various reasons, and in the future we might to leverage those in order to provide some out-of-the-box alerting mechanism, for example.
You can, however, control the retention policy for the indices stored in this cluster using the following command `bash elastic-cloud-enterprise.sh set-logging-and-metrics-policy --pattern cluster-logs-* --days 14`, you can read more about these options [here](https://www.elastic.co/guide/en/cloud-enterprise/2.0/ece-monitoring-ece-set-retention.html).
---
### Author:  [@gautu7](https://discuss.elastic.co/u/gautu7)
#### Post date: [October 10, 2018, 2:39pm UTC](https://discuss.elastic.co/t/forward-logs-from-logging-and-metrics-cluster-to-external-log-system/151531/7 "2018-10-10T14:39:28Z")
For the alerting mechanism, we use our monitoring cluster as we enable `xpack.monitoring` on our nodes. What extra does this provide as compared to the metrics sent from xpack monitoring? The reason why I ask is that sending logs to an external source may not be that common but definitely something that could be required for implementations. So, we should kind of have this de-coupled and not have to run 2 processes which do the same thing(reading logs files from the host mount directory), one which send logs to the logs cluster, the other to your external in house log system.
---
### Author:  [@zanbel](https://discuss.elastic.co/u/zanbel)
#### Post date: [October 11, 2018, 7:59am UTC](https://discuss.elastic.co/t/forward-logs-from-logging-and-metrics-cluster-to-external-log-system/151531/8 "2018-10-11T07:59:31Z")
There are more ECE specific alerting we have in mind, on top of the xpack monitoring, that can leverage the logs that are indexed in the logging and monitoring cluster. I will pass on the request to disable sending logs to the logging and monitoring cluster and evaluate if this is something we would like to include in a future version.
Hope the information provided will still provide a solution to your use case and a reasonable workaround for reduce the size of the logging and monitoring cluster by reducing the retention period.
---
### Author:  [@gautu7](https://discuss.elastic.co/u/gautu7)
#### Post date: [October 11, 2018, 2:23pm UTC](https://discuss.elastic.co/t/forward-logs-from-logging-and-metrics-cluster-to-external-log-system/151531/9 "2018-10-11T14:23:30Z")
Yes, thank you !
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 25, 2018, 2:28pm UTC](https://discuss.elastic.co/t/forward-logs-from-logging-and-metrics-cluster-to-external-log-system/151531/10 "2018-10-25T14:28:52Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.